Feeds

Stuxnet: 'Moral crime' or proportionate response?

Security experts split on cyberwar

Secure remote control for conventional and virtual desktops

Delegates at the Black Hat conference in Las Vegas are sharply split on the merits (or otherwise) of malware like Stuxnet that can be used offensively to take down infrastructure.

Stuxnet was the first malware that was publicly acknowledged to have been designed to take down physical equipment – in this case, Siemens supervisory control and data acquisition (SCADA) systems. According to recent reports it was developed by the US and Israel as part of Operation Olympic Games, a malware program started by former President Bush and expanded by the current administration.

"I think what you're talking about is a moral crime," said Marcus Ranum, faculty member of the Institute for Applied Network Security. "What you're really doing is putting civilian infrastructure on the front line in this non-existent war. The military is basically saying 'we've saved you a little old fashioned bombing - you should be happy,' but that's not appropriate."

Ranum's position brought applause from the audience, but others were less impressed. Black Hat founder Jeff Moss said that he was more supportive of using malware in this way, since it provided military options without the need to endanger human life.

"I've always thought that these were tools in the spectrum of proportional force in between harsh words and dirty looks and Mark II bombs," said Moss. "Now instead of blowing up plants and killing people you can attack the equipment, and this is another notch on the proportionality meter. If you agree with that or not it's a good tool to allow nation states to exert force without having to blow people up."

Ultimately, however, such debate is slightly pointless, F-Secure's top security man, Mikko Hypponen told The Register. The industry should focus instead on practicalities.

"Ultimately the ethics of this don't really matter – the decision has been made and this kind of stuff is going to be unavoidable." ®

Intelligent flash storage arrays

More from The Register

next story
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Go beyond APM with real-time IT operations analytics
How IT operations teams can harness the wealth of wire data already flowing through their environment for real-time operational intelligence.
The total economic impact of Druva inSync
Examining the ROI enterprises may realize by implementing inSync, as they look to improve backup and recovery of endpoint data in a cost-effective manner.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.